Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
30-12-2023 21:59
General
-
Target
1dd79746839660c6dd3d5bb2b27af50d.exe
-
Size
24KB
-
MD5
1dd79746839660c6dd3d5bb2b27af50d
-
SHA1
d425f8343d45f8a01fe0c22a0de63ee1c03c93df
-
SHA256
e40d5f883f0dc8222c4de670067b439d5b908b4f73ff923d5e1f94bee7846ab8
-
SHA512
e5b943adabd06d4b1663c5230c2d178e9cc9029174725acc445b09ab0bbcf7d9cf5d81791480eeeda577c7191a2d2ce67178266e2afab96d5d4251f728934c6c
-
SSDEEP
384:EniVoyLcKQuXb3NLK83r6nCXo29b4Pu27X3NyE90EPuNAIRzhXtoc8:EGCur3Np3eA9kPpnrrPx2zhXG/
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dd79746839660c6dd3d5bb2b27af50d.exe"C:\Users\Admin\AppData\Local\Temp\1dd79746839660c6dd3d5bb2b27af50d.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\tmp.tmp.tmp1C:\Windows\tmp.tmp.tmp12⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 2683⤵
- Program crash
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3704 -ip 37041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD550089a3b3dffcc902eb579b16a4a5c1d
SHA1a89e04d86f91fdbafb72311b6ef23e39f700c655
SHA25693957c8c22611e8b34706d3d8d703e8c73b71d8d0497ecf0ccc69eb707b57d80
SHA5126a5ff47bd827204eab01d7c793373eaed73096704e7f7d3fd56148ad31a5dbff8f50929031a82c62d82b0e9ca5243d995b59c8a9c8041bd4a3dc0a285b7fc7b8
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
8KB